Question 1

Which of these configuration or deployment practices is a security risk for RDS?
A) Storing SQL function code in plaintext
B) Non-Multi-AZ RDS instance
C) Having RDS and EC2 instances exist in the same subnet
D) RDS in a public subnet

Accepted Answer

Placing RDS in a public subnet exposes it to the internet, increasing the risk of unauthorized access and attacks.

Question 2

As CloudTrail sends a notification each time a log file is written to the Amazon S3 bucket, an account that is very active can generate a large number of notifications. If you subscribe using email or SMS, you may end up receiving a large volume of messages. Which of the following should you use to handle notifications programmatically?
A) Amazon Kinesis Firehose
B) Amazon Simple Queue Service (Amazon SQS)
C) Amazon Simple Email Service (Amazon SES)
D) Amazon AppStream

Accepted Answer

Amazon Simple Queue Service (Amazon SQS) can be used to handle notifications programmatically by queuing them, allowing you to process them asynchronously and manage the volume effectively.

Question 3

A company updated the AWS CloudFormation template for a critical business application. The stack update process failed due to an error in the updated template, and AWS CloudFormation automatically began the stack rollback process. Later, a DevOps engineer discovered that the application was still unavailable and that the stack was in the UPDATE_ROLLBACK_FAILED state. Which combination of actions should the DevOps engineer perform so that the stack rollback can complete successfully? (Choose two.)
A) Attach the AWSCloudFormationFullAccess IAM policy to the AWS CloudFormation role.
B) Automatically recover the stack resources using AWS CloudFormation drift detection.
C) Issue a ContinueUpdateRollback command from the AWS CloudFormation console or the AWS CLI.
D) Manually adjust the resources to match the expectations of the stack.
E) Update the existing AWS CloudFormation stack using the original template.

Accepted Answer

The DevOps engineer should issue a ContinueUpdateRollback command to complete the stack rollback process. Additionally, they may need to manually adjust the resources to match the expectations of the stack.

Question 4

A company is using tagging to allocate AWS costs. The company has Amazon EC2 instances that run in Auto Scaling groups. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instances are being created without the appropriate cost center tags. A DevOps engineer must ensure that the new EBS volumes are properly tagged. What is the MOST efficient solution that meets this requirement?
A) Create a lifecycle hook on the autoscaling:EC2_INSTANCE_TERMINATING instance state that attaches the cost center tags to the EBS volumes.
B) Update the Auto Scaling group launch template to include the cost center tags for EBS volumes.
C) Update the Auto Scaling group to include the cost center tags. Set the PropagateAILaunch property to true.
D) Use Tag Editor to search for EBS volumes that are missing the tags and to add the cost center tags to the volumes.

Accepted Answer

The answer of A company is using tagging to allocate...

Question 5

A company wants to use AWS development tools to replace its current bash deployment scripts. The company currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During the deployments, the company unit tests the committed application, stops and starts services, unregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to maintain the same deployment functionality through the shift to using AWS services. Which solution will meet these requirements?
A) Use AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services, and deregister and register instances with the ALB. Use the appspec.yml file to update file permissions without a custom script.
B) Use AWS CodePipeline to move the application from the AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy's deployment group to test the application, unregister and re-register instances with the ALB, and restart services. Use the appspec.yml file to update the permissions without a custom script.
C) Use AWS CodePipeline to move the application source code from the AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy to test the application. Use CodeDeploy's appspec.yml file to restart services and update permissions without a custom script. Use AWS CodeBuild to unregister and re-register instances with the ALB.
D) Use AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services. Unregister and re-register the instances in the AWS CodeDeploy deployment group with the ALB. Update the appspec.yml file to update file permissions without a custom script.

Accepted Answer

The answer of A company wants to use AWS development...

Question 6

How does Amazon RDS multi Availability Zone model work?
A) A second, standby database is deployed and maintained in a different availability zone from master, using synchronous replication.
B) A second, standby database is deployed and maintained in a different availability zone from master using asynchronous replication.
C) A second, standby database is deployed and maintained in a different region from master using asynchronous replication.
D) A second, standby database is deployed and maintained in a different region from master using synchronous replication.

Accepted Answer

Amazon RDS multi-AZ deployments use synchronous replication to maintain a standby database in a different availability zone, ensuring high availability and failover support.

Question 7

After a data leakage incident that led to thousands of stolen user profiles, a compliance officer is demanding automatic, auditable security policy checks for all of the company's data stores, starting with public access of Amazon S3 buckets. Which solution will accomplish this with the LEAST amount of effort?
A) Create a custom rule in AWS Config triggered by an S3 bucket configuration change that detects when the bucket policy or bucket ACL allows public read access. Use a remediation action to trigger an AWS Lambda function that automatically disables public access.
B) Create a custom rule in AWS Config triggered by an S3 bucket configuration change that detects when the bucket policy or bucket ACL allows public read access. Trigger an AWS Lambda function that automatically disables public access.
C) Use a managed rule in AWS Config triggered by an S3 bucket configuration change that detects when the bucket policy or bucket ACL allows public read access. Configure a remediation action that automatically disables public access.
D) Use a managed rule in AWS Config triggered by an S3 bucket configuration change that detects when the bucket policy or bucket ACL allows public read access. Configure an AWS Lambda function that automatically disables public access.

Accepted Answer

The answer of After a data leakage incident that led...

Question 8

You are in charge of a large-scale highly available multi-tier web application infrastructure. This architecture consists of Amazon Route53 with a load balancer and multiple Amazon EC2 instances. You have been tasked to come up with a process to provide Blue/Green style deployments. Which technique should you use to deliver this new requirement?
A) Using Elastic Beanstalk re-deploy your application and configure Elastic Beanstalk Deployment types, and then use Amazon Route53's alias resource record set to swap between Elastic Beanstalk deployment types.
B) Re-deploy your application behind a load balancer using an AWS CloudFormation template, launch a new AWS CloudFormation stack during each deployment, update your Amazon Route53 alias resource record set to point to the new load balancer, and finally, terminate your old AWS CloudFormation stack.
C) Re-deploy your application behind a load balancer using Auto Scaling groups, create a new identical Auto Scaling group, and associate it to the load balancer. During deployment, create a new Amazon Route53 hosted zone, add this new load balancer to the zone in an alias resource record set, and then remove your old Auto Scaling group.
D) Re-deploy your application behind a load balancer using an OpsWorks stack, and use AWS OpsWorks stack versioning. During deployment, create a new version of your application, tell OpsWorks to launch the new version behind your load balancer, and when the new version launches, update your Amazon Route53 alias resource retort to point to the new load balancer.

Accepted Answer

This approach uses AWS CloudFormation to manage infrastructure as code, allowing for easy creation and deletion of resources. By updating the Route53 alias to point to the new load balancer, you can effectively switch traffic to the new environment, achieving a Blue/Green deployment.

Question 9

Your company wants to understand where cost is coming from in the company's production AWS account. There are a number of applications and services running at any given time. Without expending too much initial development time, how best can you give the business a good understanding of which applications cost the most per month to operate?
A) Create an automation script which periodically creates AWS Support tickets requesting detailed intra-month information about your bill.
B) Use custom CloudWatch Metrics in your system, and put a metric data point whenever cost is incurred.
C) Use AWS Cost Allocation Tagging for all resources which support it. Use the Cost Explorer to analyze costs throughout the month.
D) Use the AWS Price API and constantly running resource inventory scripts to calculate total price based on multiplication of consumed resources over time.

Accepted Answer

AWS Cost Allocation Tagging allows you to categorize and track your AWS costs by assigning tags to your resources. Using Cost Explorer, you can then analyze these tagged resources to understand the cost distribution across different applications and services. This approach requires minimal initial development effort compared to other options.

Question 10

What is the correct syntax for the AWS command to create a single region trail?
A) aws create-trail --name trailname --s3-object objectname
B) aws cloudtrail --s3-regionname IPaddress create-trail --name trailname
C) aws cloudtrail create-trail --name trailname --s3-bucket-name bucketname
D) aws cloudtrail create-trail --name trailname --s3-portnumber IPaddress

Accepted Answer

The correct syntax for creating a single region trail in AWS CloudTrail includes specifying the trail name and the S3 bucket name where logs will be stored.

Exam 12: AWS DevOps Engineer - Professional (DOP-C01)

Which of these configuration or deployment practices is a security risk for RDS?

How does Amazon RDS multi Availability Zone model work?

What is the correct syntax for the AWS command to create a single region trail?